Third party program integrity and integration control in web based applications

ABSTRACT

Disclosed herein are a resource control service, system, method and architecture. A client device&#39;s resource access is limited to an approved resource, or resources. A request for a resource is directed to a resource control service that determines whether or not to grant access to the requested resource. Where a determination is made to grant access to the resource, a response is transmitted to the client device, the response redirecting the client device to a second URI for the approved version of the requested resource. The response can be used by the client device request the resource from the location identified in the response.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of and claims priority fromco-pending U.S. patent application Ser. No. 15/420,727, filed Jan. 31,2017, entitled THIRD PARTY PROGRAM INTEGITY AND INTEGRATION CONTROL INWEB-BASED APPLICATIONS which issued as U.S. Pat. No. 10,069,835 on Sep.4, 2018, and which is a continuation of and claims priority from U.S.patent application Ser. No. 13/446,381, filed Apr. 13, 2012, entitledTHIRD PARTY PROGRAM INTEGITY AND INTEGRATION CONTROL IN WEB-BASEDAPPLICATIONS, which issued as U.S. Pat. No. 9,576,064 on Feb. 21, 2017,each of which is hereby incorporated by reference.

FIELD OF THE DISCLOSURE

The present disclosure is directed to integration of web resources, suchas web applications provided by a third party, in a web site, and moreparticularly, to monitoring the web applications integrated in a website and controlling access such that access via the web site is limitedto approved web applications.

BACKGROUND

A web-based, or web, application is an application that is accessed overa network such as the Internet, or other network. The application maycomprise program code, such as JavaScript or Adobe Flash code, which isexecuted by a computing device, e.g., a server computer, a usercomputer, etc., for example. A web site typically includes one or moreweb pages, each of which can include at least one web application, e.g.,a link that results in the web application being executed on the servercomputer, the user computer or both. In some cases, a web applicationthat is accessible via the web site's web page is provided by an entity,or third party, other than the web site entity, or party, providing theweb site.

Since a web application can include powerful commands that can instructthe application to perform privileged operations on the web site and/orthe user's computing device, the web site entity has an interest inensuring that each web application that is accessible via the web siteis trustworthy. Under the control of an untrustworthy web application,the web site and/or the user's computing device become vulnerable andthe security of the web site and/or the user's computer device can becompromised by the web application's programming commands.

Security concerns can result in a web site entity avoiding partneringwith third party web application providers, particularly third part webapplication providers having few resources to guarantee thetrustworthiness of their web applications. A result being a web siteentity forgoes including a web application with desirable functionalitydue to security concerns.

SUMMARY

The present disclosure seeks to address failings in the art and toprovide monitoring and integration control of third party webapplications. In accordance with one or more embodiments, the monitoringand integration control uses a redirect mechanism. The monitoring andintegration control periodically fetches and analyzes a set of thirdparty applications that a web site uses, e.g., has a dependency. Themonitoring and integration control can recursively examine dependenciesof each third party application in the set as well. If the monitoringand integration control detects changes in a third party application,e.g., a change in the execution or program flow of the application, itcan be configured to alert a review by a system user, referred to hereinas a reviewer, and/or an automated review component to review the webapplication in order to determine whether or not to approve theapplication. Where the application is not approved, the monitoring andintegration control can deny access to the application.

In accordance with one or more embodiments, the monitoring andintegration control involves most if not all of the requests for thirdparty web applications made via the web site. By way of a non-limitingexample, each request made for a third party web application made viathe web site is directed to the monitoring and integration control, andwhere the request is for an approved application, the requester, e.g., aclient application running on a user's computing device is redirected tothe web application. In so doing, the monitoring and integration controldetermines whether to allow or block/deny access to each web applicationover which it has control.

In accordance with an aspect of the present disclosure, a method isprovided comprising receiving a request for a resource from a clientdevice, the request being directed to a resource control service using afirst uniform resource identifier (URI) received with the request, theresource control service being provided by at least one server computer;performing, by the resource control service, at least one check of therequested resource to determine whether to grant access to the requestedresource by the client device, the at least one check includingdetermining whether an approved version of the requested resource isavailable for access by the client device; determining, by the resourcecontrol service, whether or not to grant access to the requestedresource based on the at least one check; and where the resource controlservice makes a determination to grant access to the requested resourcebased on the at least one check, the resource control service causing aresponse to be transmitted to the client device, the responseredirecting the client device to a second URI for the approved versionof the requested resource.

In accordance with another aspect, a system is provided, which comprisesat least one server computer comprising one or more processors toexecute and memory to store instructions for a resource control serviceto receive a request for a resource from a client device, the requestbeing directed to the resource control service using a first uniformresource identifier (URI) received with the request; perform at leastone check of the requested resource to determine whether to grant accessto the requested resource by the client device, the at least one checkincluding determining whether an approved version of the requestedresource is available for access by the client device; determine whetheror not to grant access to the requested resource based on the at leastone check; and where it makes a determination to grant access to therequested resource based on the at least one check, cause a response tobe transmitted to the client device, the response redirecting the clientdevice to a second URI for the approved version of the requestedresource.

In accordance yet another aspect, a computer readable non-transitorystorage medium is provided, the medium for tangibly storing thereoncomputer readable instructions that when executed cause at least oneprocessor to provide a resource control service to receive a request fora resource from a client device, the request being directed to theresource control service using a first uniform resource identifier (URI)received with the request; perform at least one check of the requestedresource to determine whether to grant access to the requested resourceby the client device, the at least one check including determiningwhether an approved version of the requested resource is available foraccess by the client device; determine whether or not to grant access tothe requested resource based on the at least one check; and where itmakes a determination to grant access to the requested resource based onthe at least one check, cause a response to be transmitted to the clientdevice, the response redirecting the client device to a second URI forthe approved version of the requested resource.

In accordance with one or more embodiments, a system is provided thatcomprises one or more computing devices configured to providefunctionality in accordance with such embodiments. In accordance withone or more embodiments, functionality is embodied in steps of a methodperformed by at least one computing device. In accordance with one ormore embodiments, program code to implement functionality in accordancewith one or more such embodiments is embodied in, by and/or on acomputer-readable medium.

DRAWINGS

The above-mentioned features and objects of the present disclosure willbecome more apparent with reference to the following description takenin conjunction with the accompanying drawings wherein like referencenumerals denote like elements and in which:

FIG. 1 provides an exemplary overview of system components in accordancewith one or more embodiments of the present disclosure.

FIG. 2 provides universal resource identifier (URI) examples and anexample of a response for use in accordance with one or more embodimentsof the present disclosure.

FIG. 3, which comprises FIGS. 3A and 3B, provides a process flow inaccordance with one or more embodiments of the present disclosure.

FIG. 4, which comprises FIGS. 4A and 4B, provides a process flow inaccordance with one or more embodiments of the present disclosure.

FIG. 5 illustrates some components that can be used in connection withone or more embodiments of the present disclosure.

FIG. 6 is a detailed block diagram illustrating an internal architectureof a computing device in accordance with one or more embodiments of thepresent disclosure.

DETAILED DESCRIPTION

Subject matter will now be described more fully hereinafter withreference to the accompanying drawings, which form a part hereof, andwhich show, by way of illustration, specific example embodiments.Subject matter may, however, be embodied in a variety of different formsand, therefore, covered or claimed subject matter is intended to beconstrued as not being limited to any example embodiments set forthherein; example embodiments are provided merely to be illustrative.Likewise, a reasonably broad scope for claimed or covered subject matteris intended. Among other things, for example, subject matter may beembodied as methods, devices, components, or systems. Accordingly,embodiments may, for example, take the form of hardware, software,firmware or any combination thereof (other than software per se). Thefollowing detailed description is, therefore, not intended to be takenin a limiting sense.

Throughout the specification and claims, terms may have nuanced meaningssuggested or implied in context beyond an explicitly stated meaning.Likewise, the phrase “in one embodiment” as used herein does notnecessarily refer to the same embodiment and the phrase “in anotherembodiment” as used herein does not necessarily refer to a differentembodiment. It is intended, for example, that claimed subject matterinclude combinations of example embodiments in whole or in part.

In general, terminology may be understood at least in part from usage incontext. For example, terms, such as “and”, “or”, or “and/or,” as usedherein may include a variety of meanings that may depend at least inpart upon the context in which such terms are used. Typically, “or” ifused to associate a list, such as A, B or C, is intended to mean A, B,and C, here used in the inclusive sense, as well as A, B or C, here usedin the exclusive sense. In addition, the term “one or more” as usedherein, depending at least in part upon context, may be used to describeany feature, structure, or characteristic in a singular sense or may beused to describe combinations of features, structures or characteristicsin a plural sense. Similarly, terms, such as “a,” “an,” or “the,” again,may be understood to convey a singular usage or to convey a pluralusage, depending at least in part upon context. In addition, the term“based on” may be understood as not necessarily intended to convey anexclusive set of factors and may, instead, allow for existence ofadditional factors not necessarily expressly described, again, dependingat least in part on context.

The detailed description provided herein is not intended as an extensiveor detailed discussion of known concepts, and as such, details that areknown generally to those of ordinary skill in the relevant art may havebeen omitted or may be handled in summary fashion.

Generally, the present disclosure includes a resource monitoring andintegration control service, system, method and architecture. Inaccordance with one or more embodiments, requests to access resourcesare monitored and controlled in order limit access to approvedresources. A request for a resource is directed to resource monitoringand integration control, which determines whether or not to grant accessto the requested resource. In accordance with one or more embodiments,the resource request is formed using the Hypertext Transport Protocol(HTTP), e.g., an HTTP GET request. Where a determination is made togrant access to the resource, a response is transmitted to therequesting device, a user's computing device, the response redirectingthe requesting device to a second URI for the approved version of therequested resource. In accordance with one or more embodiments, theresponse redirecting the device to the requested resource uses the HTTPformat and includes a “302 Found” status code and location of therequested resource. The response can be used by the requesting device todirect the resource request to the location identified in the response.

In accordance to one or more embodiments, the determination whether ornot to grant access to the resource can be made using one or moreintegrity checks for the requested resource. One such integrity checkthat is made in accordance with one or more embodiments, is a check toensure that the requested resource is approved for access by arequester. Approval of a resource can be based on whether or not theresource is performing a prohibited operation and/or will cause aprohibited operation to be performed, e.g., requested resource causesanother resource to be accessed that includes a prohibited operation. Byway of some non-limiting examples, a prohibited operation can be anysuspect operation, such as a suspect browser cache access, a call to asuspect function, sending information retrieved from a user's device,e.g., browser cache and/or cookies, to a suspect location, and/orsending information retrieved from a server computer to a suspectlocation. In accordance with one or more embodiments, where a prohibitedoperation is identified with a resource, the resource's approval statuscan indicate that the resource is “not approved,” and access to theresource can be denied based on the resource's approval status.

In accordance with one or more embodiments, a resource can be reviewedto determine whether or not to approve the resource for access. By wayof some non-limiting examples, the review can be performed by a user,e.g., a system user, administrative user, etc., and/or by one or moreautomated analysis tools, e.g., static code analysis tool(s), todetermine whether or not to approve access to the resource. The approvalstatus can be determined prior to receipt of a request, so that where arequest for the resource is received, an integrity check of theresource's approval status can include accessing a data store toretrieve a stored approval status of the resource. Alternatively, thereview can be performed in response to a requests for the resource.

FIG. 1 provides an exemplary overview of system components in accordancewith one or more embodiments of the present disclosure. System 100receives a request from client application 104 for resource 122 providedby resource provider 124. In accordance with one or more embodiments,system 100 can be provided by a first entity, e.g., a web site provider,and resource provider can be a second entity different from the firstentity. Alternatively, the first and second entity can be the sameentity.

The request for resource 122 can be made by client application 104executing on computing device 102, e.g., an end user's computing device.By way of a non-limiting example, the client application 104 can be abrowser application displaying a web page of a web site provided by thefirst entity providing system 100. The web site provider can be hostingthe resource 122 provided by the resource provider 124, and can beoffering access to resource 122 via at least one web page that includesa first link, e.g., a first Universal Resource Identifier (URI), whichis directed to resource request handler 110 of system 100. Where theresource 122 is approved by system 100, resource request handler 110responds to the request with a second link, e.g., a second URI, which ittransmits to client application 104. The client application 104 uses thesecond URI to access resource 122 from resource provider 124.

Where the resource request handler 110 receives the request for resource122 from client application 104, the resource request handler 110forwards the request to authorization service 112, which determineswhether or not to grant access to the requested resource. In accordancewith one or more embodiments, a resource can be approved by a reviewer126 and/or a automated analysis tool (not shown). By way of anon-limiting example, reviewer 126 can be a system user that reviews theresource and determines whether or not to approve access to the resource122 via a user interface 114. By way of a further non-limiting example,an automated analysis tool can include a static code analysis toolinvoked by authorization service 112. An automated tool can be a part ofsystem 100 or can be provided by an external source, e.g., a trustedsource.

Data store 120 comprises information about the resource 122, such as byway of some non-limiting examples, the approval status, e.g., approvedor not approved, of the resource 122; resource provider 124identification information, such as the name or other identifier ofresource provider 124; resource 122 identification information, e.g.,resource name, digital signature and version number or other identifieridentifying the latest version of the resource 122 approved by system100; user authorization information to determine whether or not toauthorize a user's access of the resource 122, such as identification ofusers authorized to access the resource 122 and/or a number ofauthorized user accesses in a time period, which information can bespecified, for example, globally for all users, for a group of users orfor each user individually.

The authorization service 112 uses information contained in the requestto identify the resource 122 and access information about the resource122 stored in data store 120. The authorization service 112 performs atleast one check for the requested resource 122 to determine whether ornot to grant access to the requested resource 122 by the clientapplication 104. In accordance with one or more embodiments, theauthorization service 112 determines whether an approved version of therequested resource 122 is available for access by the client application104. The authorization service 112 retrieves the approval status of theresource 122 from the data store 120. Additionally, the authorizationservice 112 can retrieve information to determine whether the user isauthorized to access the resource 122. In addition to the userauthorization information stored in data store 120, the authorizationservice 122 can access the user's identification information, which canbe retrieved from a cookie store 106 on the computing device 102 orincluded with the request, for example.

The authorization service 112 forwards its determination whether togrant or deny access to the requested resource 122 to resource requesthandler 110. Where the authorization service 112 makes a determinationto grant access to the requested resource 122, the resource requesthandler 110 forwards the second URI to client application 104, whichclient application 104 can use to access the resource 122 from resourceprovider 124. Where the authorization service 112 makes a determinationto deny access to the requested resource 122, resource request handler110 can forward a message to client application 104 indicating that theaccess is not available for access. The message can notify the user toretry the request at a later time, to provide time for the system 100 toreview the resource 122.

In accordance with one or more embodiments, authorization servicecomprises a user interface, which can be used by a reviewer 126 to viewa resource, e.g., the resource requested by client application 104, andspecify the approval status for the resource 122, e.g., approved or notapproved. The approval status provided by the reviewer 126 via userinterface 114 is forwarded by authorization service 112 to data store120.

In accordance with one or more embodiments, administrative service 116can comprise a user interface 118. Administrative service 116 can beaccessed by administrator 128, e.g., a system user, via user interface118 to configure system 100. By way of some non-limiting examples,administrator 128 can configure parameters specifying the type of errorhandling to be performed where a resource authorization fails and/or aresource request is denied, configure parameters specifying levels oflogging, frequency of analyzing versions of resources from third partysources, local or remote hosting of third party programming content,etc. Configuration information entered by the administrator 128 can bestored in data store 120 by administrative service 116.

In accordance with one or more embodiments, system 100 can be configuredsuch that authorization service 112 can alert reviewer 126 via userinterface 114 where the request for the resource 122 by clientapplication 104 was denied. The reviewer 126 can review the matter,e.g., review the reason for the denial and/or the resource 122, anddetermine whether or not to grant or deny the request and/or to updatethe approval status for the resource 122 via user interface 114.Authorization service 112 can forward any changes to the approval statusfor the resource 122 to data store 120 based on the reviewer's 126input. Where the reviewer 126 makes a determination to grant the requestby client application 104 to access resource 122, authorization service112 can notify resource request handler 110.

As discussed herein, approval or non-approval of the resource 122 can bedetermined based on whether or not the resource 122 performs aprohibited operation and/or the resource 122 invokes another resource toperform a prohibited operation. Some non-limiting examples of operationsthat might be prohibited and result in non-approval of the resource 122include prohibited references to document object model (DOM) objects,prohibited accesses to cookie store 106 and/or cache 108, e.g., cache ofclient application 104, references to programming code or other modulesexternal to resource 122. In accordance with one or more embodiments,what constitutes a prohibited function can be specified as part of theconfiguration of system 100.

In the example shown in FIG. 1, system 100 includes resource requesthandler 110, authorization service 112 and administrative service 116 asseparate components. It should be apparent that the components need notbe separate, and that any one or more of the components can be combinedinto a single component, with the single component performing thefunctionality of the combined components. Furthermore, it should beapparent that one or more of the components can be broken into multiplecomponents, with the functionality of the component being split by themultiple components.

FIG. 2 provides universal resource identifier (URI) examples and anexample of a response for use in accordance with one or more embodimentsof the present disclosure. Syntax 200 provides an example of a format orsyntax of a first URI. Syntax 200 comprises a field 222 that contains areference to a first entity, e.g., a provider of system 100. Field 222can be used to direct the request to resource request handler 110 of thefirst entity. In the example of FIG. 2, syntax 200 further comprisesfield 224 identifying a resource type of resource 122. By way of somenon-limiting examples, field 224 can identify the resource as aJavaScript™, Adobe Flash™, etc. resource. Fields 226 and 228 containinformation identifying the provider 124 of the resource 122 andinformation identifying the resource 122. Syntax 200 can optionallyinclude one or more parameters 230, which can be parameters supplied byclient application 104 for use with resource 122, for example.

URI 220 provides an example of the first URI using syntax 200. Field 222contains a reference to direct the request to resource request handler110. Field 224 identifies the resource 122 as being a JavaScript™resource type. Field 226 identifies resource provider 124, and field 228provides the name of the resource 122. Field 230 includes a parameterfor use with the resource 122.

Response 240 is an example of information that is provided, inaccordance with HTTP, by the request handler 110 in response to arequest made by client application 104. The response 240 is made wheresystem 100 makes a determination to grant the request by clientapplication 104 to access to the resource 122. In accordance with one ormore embodiments, the response 240 includes a status code, e.g., “302Found” indicating that the resource 122 exists and instructing theclient application 104 to use location information 244 to accessresource 122. In accordance with one or more embodiments, locationinformation 244 is a second URI that includes the domain, path andresource identification information of the resource 122, as well as theparameters 230. As discussed, where system 100 determines to deny accessto the resource 122, request handler 110 can forward an error message inresponse to the request made by client application 104.

FIG. 3, which comprises FIGS. 3A and 3B, provides a process flow inaccordance with one or more embodiments of the present disclosure. Inaccordance with one or more embodiments, the process flow is implementedby components of system 100. At step 302, the request for the resource122 is received by the resource request handler 110. In accordance withone or more embodiments, the resource request handler 110 retrievesresource control rules, e.g., approval status, user authorization rules,etc., from data store 120 for use by authorization service 112 todetermine whether or not to grant access to the requested resource 122by client application 104. At step 306, a determination is made whetherthe control rules were available, e.g., from data store 120. If thecontrol rules were not available, processing continues at step 308 toprocess the error. The error can result in a notification directed toreviewer 126 to provide the missing control rules for resource 122, andclient application 104 can be notified, in a response to the request,that the resource 122 is not currently available for access.

If it is determined, at step 306, that the control rules weresuccessfully retrieved, processing continues at step 310. At step 310, adetermination is made whether or not the user is authorized to accessthe resource 122. By way of some non-limiting examples, authorizationservice 112 can determine whether the control rules retrieved from datastore 120 identifies the user as an authorized user. If not, processingcontinues at step 308, so that the resource request handler 110 cannotify the user, in response to the request, that the user is notauthorized to access the requested resource 122. In addition, where acontrol rule identifies that the user is limited to a threshold numberof accesses in a period of time, authorization service 112 candetermine, at step 310, whether the number of times that the user hasaccessed the resource 122 exceeds the threshold. If so, processingcontinues at step 308 to process the error, e.g., to respond to therequest for the resource 122 by notifying the user that the user hasexceeded the threshold number of accesses. If it is determined, at step310, that the user is authorized to access the requested resource 122,processing continues at step 312.

At step 312, the authorization service 112, determines whether or notthe requested resource 122 is approved for access. By way of anon-limiting example, the authorization service 112 checks the approvalstatus of the resource 122 to determine whether or not the currentversion of the resource 122 is approved for access. Where the approvalstatus of the resource 122 indicates an approval to access the resource122, system 100 can determine whether or not the current version of theresource 122 retrievable from provider 124 is the same version as theapproved version of the resource 122. System 100 can use the second URIstored in the data store 120 to retrieve the resource 122 from resourceprovider 124 and generate a signature, e.g., using a hash or otherfunction, using the contents of the resource 122 retrieved from provider124. The generated signature can be compared with a signature stored indata store 120. The stored signature can be a signature generated fromthe version of resource 122 approved by system 100. Where the generatedand stored signatures are compared and determined to be a match, system100 determines that the resource 122 from provider 124 is the approvedversion of the resource 122. Processing continues at step 316, wherebyresource request handler 110 returns a response, e.g., response 240,directing the client application 104 to access the resource 122 via theresource provider 124.

In accordance with one or more embodiments, the system 100 can give aresource provider 124 a grace period, such that during the grace period124 the resource 122 is available for access without approval of theresource 122 by system 100. The grace period might be available to atrusted third party, for example. A threshold period of freshness can betwelve hours, for example, in which a new resource 122 is available foraccess without prior approval by system 100. Where no grace period is tobe provided, the grace period can be expressed as a null period and/oras being expired, for example. Reviewer 126 and/or administrator 128 canspecify the grace period for a given provider 124 and/or resource 122.The grace period may begin when the resource 122 is included in a website of the first provider, for example. Alternatively, the resourceprovider 122 can provide notification to system 122 that it wishes toprovide a new resource or a new version of the resource, and the graceperiod can begin at some point after the notification. As yet anotheralternative, the reviewer 126 and/or administrator 128 can identify thestart and end times of the grace period.

If it is determined at step 312, that the current version of theresource 122 is not approved, processing continues at step 314 todetermine whether or not the grace period for the resource 122 hasexpired, e.g., the “freshness” of the resource 122 exceeds the thresholdgrace period specified for the resource 122. If the freshness of theresource 122 exceeds the threshold amount of time, processing continuesat step 308 to process the error, e.g., the resource request handler 110can notify client application 104 that the requested resource 122 is notcurrently available for access and/or alert the reviewer 126 and/oradministrator 128.

If it is determined, at step 314, that the freshness of the resource 122is within the specified threshold, processing continues at step 316 toreturn the second URI and direct the client application 104 to use thesecond URI to access the requested resource 122.

FIG. 4, which comprises FIGS. 4A and 4B, provides a process flow inaccordance with one or more embodiments of the present disclosure. Asdiscussed herein, a review of resource 122 can be performed by areviewer 126 and/or an automated analysis tool, such as a static codeanalysis tool. Configuration information specified by an administrator128, for example, can be used to determine whether an automated reviewis to be performed, as well as what automated review is to be performed,and/or whether or not a reviewer 126 is to perform a review of theresource 122.

At step 402, the configuration information is used to determine whetheror not to perform an automated review of resource 122. If at least oneautomated review is to be performed, processing continues at step 404 toperform the automated review(s). At step 406 a determination is madewhether or not an automated review identified a suspect or prohibitedoperation in connection with the resource 122. In accordance with one ormore embodiments, where the resource 122 accesses another resource, thereview can be performed recursively, such that each resource that wouldbe accessed can be reviewed.

If it is determined, at step 406, that a prohibited or suspect operationis not detected, processing continues at step 316 of FIG. 3B to returnthe second URI to client application 104. In this example, it is assumedthat system 100 is configured to use automated analysis tools and not areviewer 126 to detect a prohibited or suspect operation in connectionwith the resource 122. Alternatively, where system 100 is configured touse reviewer 126 to detect a prohibited or suspect operation, processingcan continue to step 424 to make the resource 122 and the results of theanalysis conducted by the automated analysis tool(s) available to thereviewer 126, e.g., via authorization service 112 and user interface114.

In the example of FIG. 4, the system 100 can be configured to requestthat a reviewer 126 conduct a review of the resource where aprohibited/suspect operation is detected by an automated review(s)conducted by one or more automated analysis tools. If it is determined,at step 406, that the automated review(s) detected a prohibitedoperation, processing continues at step 408 to determine, based on theconfiguration, whether or not to request that the reviewer 126 perform areview of the resource 122. Where the configuration informationspecifies that a review is not be conducted by a reviewer 126, theauthorization service 112 can store an approval status indicating thatthe resource 122 is not approved in data store 120. Where there is arequest from client 114 for the resource 122, the authorization service112 can notify resource request handler 110 to respond to the requestindicating that the resource 122 is not available for access.

If it is determined, at step 408, that the resource 122 is to bereviewed by reviewer 124, processing continues at step 424 to make theresource 122 and the results of the automated review(s) available to thereviewer 124 via user interface 114 of authorization service 112. Atstep 426, a determination is made whether or not the reviewer 124 hasprovided input indicating that the resource 122 is approved. If so, datastore 120 is updated, and where there is a request for the resource 122from client application 104, processing continues at step 316 of FIG.3B, to make the resource 122 available to the client application 104. Ifit is determined, at step 426 that input indicating approval of theresource 122 has not been received, processing continues at step 428 todetermine whether or not the reviewer 126 has indicated that theresource 122 is not approved. If so, data store 120 is updated, andprocessing continues at step 308 to process the error. If it isdetermined that input has not yet been received from the reviewer 126,processing continues at step 430 to determine whether a period of time,e.g., a period of time for review, grace period, and/or for response tothe request by client application 104, has expired. If so, where thereis a request for the resource 122, processing continues at step 308 ofFIG. 3A to notify the client application 104 that the resource 122 isnot currently available. Where the reviewer 124 provides an approvalstatus for the resource 122, even where the submission occurs after thetime period for response to the request, the approval status is storedin data store 120. If it is determined, at step 430, that the timeperiod for response has not expired, processing can continue at step 426to determine whether the reviewer 124 has submitted input for theapproval status of the resource 122.

FIG. 5 illustrates some components that can be used in connection withone or more embodiments of the present disclosure. In accordance withone or more embodiments of the present disclosure, one or more computingdevices, e.g., one or more servers, computing devices 102 or othercomputing device, are configured to comprise functionality describedherein. For example, a computing device 502 can be configured to executeprogram code, instructions, etc. to provide functionality in accordancewith one or more embodiments of the present disclosure. The same oranother computing device 502 can be configured to provide system 100.

Computing device 502 can serve content to user computing devices 504,e.g., computing devices 102, using a browser application via a network506. Data store 508, which can include data store 120, can be used tostore data as described herein, as well as program code to configure aserver 502 to execute functionality, such as that described herein inconnection with system 100.

The user computing device 504, and/or user device 102, can be anycomputing device, including without limitation a personal computer,personal digital assistant (PDA), wireless device, cell phone, internetappliance, media player, home theater system, and media center, or thelike. For the purposes of this disclosure a computing device includes aprocessor and memory for storing and executing program code, data andsoftware, and may be provided with an operating system that allows theexecution of software applications in order to manipulate data. Acomputing device such as server 502 and the user computing device 504can include one or more processors, memory, a removable media reader,network interface, display and interface, and one or more input devices,e.g., keyboard, keypad, mouse, etc. and input device interface, forexample. One skilled in the art will recognize that server 502 and usercomputing device 504 may be configured in many different ways andimplemented using many different combinations of hardware, software, orfirmware.

In accordance with one or more embodiments, a computing device 502 canmake a user interface available to a user computing device 504 via thenetwork 506. The user interface made available to the user computingdevice 504 can include content items, or identifiers (e.g., URLs)selected for the user interface in accordance with one or moreembodiments of the present invention. In accordance with one or moreembodiments, computing device 502 makes a user interface available to auser computing device 504 by communicating a definition of the userinterface to the user computing device 504 via the network 506. The userinterface definition can be specified using any of a number oflanguages, including without limitation a markup language such asHypertext Markup Language, scripts, applets and the like. The userinterface definition can be processed by an application executing on theuser computing device 504, such as a browser application, to output theuser interface on a display coupled, e.g., a display directly orindirectly connected, to the user computing device 504.

In an embodiment the network 506 may be the Internet, an intranet (aprivate version of the Internet), or any other type of network. Anintranet is a computer network allowing data transfer between computingdevices on the network. Such a network may comprise personal computers,mainframes, servers, network-enabled hard drives, and any othercomputing device capable of connecting to other computing devices via anintranet. An intranet uses the same Internet protocol suit as theInternet. Two of the most important elements in the suit are thetransmission control protocol (TCP) and the Internet protocol (IP).

As discussed, a network may couple devices so that communications may beexchanged, such as between a server computing device and a clientcomputing device or other types of devices, including between wirelessdevices coupled via a wireless network, for example. A network may alsoinclude mass storage, such as network attached storage (NAS), a storagearea network (SAN), or other forms of computer or machine readablemedia, for example. A network may include the Internet, one or morelocal area networks (LANs), one or more wide area networks (WANs),wire-line type connections, wireless type connections, or anycombination thereof. Likewise, sub-networks, such as may employdiffering architectures or may be compliant or compatible with differingprotocols, may interoperate within a larger network. Various types ofdevices may, for example, be made available to provide an interoperablecapability for differing architectures or protocols. As one illustrativeexample, a router may provide a link between otherwise separate andindependent LANs. A communication link or channel may include, forexample, analog telephone lines, such as a twisted wire pair, a coaxialcable, full or fractional digital lines including T1, T2, T3, or T4 typelines, Integrated Services Digital Networks (ISDNs), Digital SubscriberLines (DSLs), wireless links including satellite links, or othercommunication links or channels, such as may be known to those skilledin the art. Furthermore, a computing device or other related electronicdevices may be remotely coupled to a network, such as via a telephoneline or link, for example.

A wireless network may couple client devices with a network. A wirelessnetwork may employ stand-alone ad-hoc networks, mesh networks, WirelessLAN (WLAN) networks, cellular networks, or the like. A wireless networkmay further include a system of terminals, gateways, routers, or thelike coupled by wireless radio links, or the like, which may movefreely, randomly or organize themselves arbitrarily, such that networktopology may change, at times even rapidly. A wireless network mayfurther employ a plurality of network access technologies, includingLong Term Evolution (LTE), WLAN, Wireless Router (WR) mesh, or 2nd, 3rd,or 4th generation (2G, 3G, or 4G) cellular technology, or the like.Network access technologies may enable wide area coverage for devices,such as client devices with varying degrees of mobility, for example.For example, a network may enable RF or wireless type communication viaone or more network access technologies, such as Global System forMobile communication (GSM), Universal Mobile Telecommunications System(UMTS), General Packet Radio Services (GPRS), Enhanced Data GSMEnvironment (EDGE), 3GPP Long Term Evolution (LTE), LTE Advanced,Wideband Code Division Multiple Access (WCDMA), Bluetooth, 802.11b/g/n,or the like. A wireless network may include virtually any type ofwireless communication mechanism by which signals may be communicatedbetween devices, such as a client device or a computing device, betweenor within a network, or the like.

Signal packets communicated via a network, such as a network ofparticipating digital communication networks, may be compatible with orcompliant with one or more protocols. Signaling formats or protocolsemployed may include, for example, TCP/IP, UDP, DECnet, NetBEUI, IPX,Appletalk, or the like. Versions of the Internet Protocol (IP) mayinclude IPv4 or IPv6. The Internet refers to a decentralized globalnetwork of networks. The Internet includes local area networks (LANs),wide area networks (WANs), wireless networks, or long haul publicnetworks that, for example, allow signal packets to be communicatedbetween LANs. Signal packets may be communicated between nodes of anetwork, such as, for example, to one or more sites employing a localnetwork address. A signal packet may, for example, be communicated overthe Internet from a user site via an access node coupled to theInternet. Likewise, a signal packet may be forwarded via network nodesto a target site coupled to the network via a network access node, forexample. A signal packet communicated via the Internet may, for example,be routed via a path of gateways, servers, etc. that may route thesignal packet in accordance with a target address and availability of anetwork path to the target address.

It should be apparent that embodiments of the present disclosure can beimplemented in a client-server environment such as that shown in FIG. 5.Alternatively, embodiments of the present disclosure can be implementedwith other environments. As one non-limiting example, a peer-to-peer (orP2P) network may employ computing power or bandwidth of networkparticipants in contrast with a network that may employ dedicateddevices, such as dedicated servers, for example; however, some networksmay employ both as well as other approaches. A P2P network may typicallybe used for coupling nodes via an ad hoc arrangement or configuration. Apeer-to-peer network may employ some nodes capable of operating as botha “client” and a “server.”

FIG. 6 is a detailed block diagram illustrating an internal architectureof a computing device, e.g., a computing device such as server 502 oruser computing device 504, in accordance with one or more embodiments ofthe present disclosure. As shown in FIG. 6, internal architecture 600includes one or more processing units, processors, or processing cores,(also referred to herein as CPUs) 612, which interface with at least onecomputer bus 602. Also interfacing with computer bus 602 arecomputer-readable medium, or media, 606, network interface 614, memory604, e.g., random access memory (RAM), run-time transient memory, readonly memory (ROM), etc., media disk drive interface 620 as an interfacefor a drive that can read and/or write to media including removablemedia such as floppy, CD-ROM, DVD, etc. media, display interface 610 asinterface for a monitor or other display device, keyboard interface 616as interface for a keyboard, pointing device interface 618 as aninterface for a mouse or other pointing device, and miscellaneous otherinterfaces not shown individually, such as parallel and serial portinterfaces, a universal serial bus (USB) interface, and the like.

Memory 604 interfaces with computer bus 602 so as to provide informationstored in memory 604 to CPU 612 during execution of software programssuch as an operating system, application programs, device drivers, andsoftware modules that comprise program code, and/or computer-executableprocess steps, incorporating functionality described herein, e.g., oneor more of process flows described herein. CPU 612 first loadscomputer-executable process steps from storage, e.g., memory 604,computer-readable storage medium/media 606, removable media drive,and/or other storage device. CPU 612 can then execute the stored processsteps in order to execute the loaded computer-executable process steps.Stored data, e.g., data stored by a storage device, can be accessed byCPU 612 during the execution of computer-executable process steps.

Persistent storage, e.g., medium/media 606, can be used to store anoperating system and one or more application programs. Persistentstorage can also be used to store device drivers, such as one or more ofa digital camera driver, monitor driver, printer driver, scanner driver,or other device drivers, web pages, content files, playlists and otherfiles. Persistent storage can further include program modules and datafiles used to implement one or more embodiments of the presentdisclosure, e.g., listing selection module(s), targeting informationcollection module(s), and listing notification module(s), thefunctionality and use of which in the implementation of the presentdisclosure are discussed in detail herein.

For the purposes of this disclosure a computer readable medium storescomputer data, which data can include computer program code that isexecutable by a computer, in machine readable form. By way of example,and not limitation, a computer readable medium may comprise computerreadable storage media, for tangible or fixed storage of data, orcommunication media for transient interpretation of code-containingsignals. Computer readable storage media, as used herein, refers tophysical or tangible storage (as opposed to signals) and includeswithout limitation volatile and non-volatile, removable andnon-removable media implemented in any method or technology for thetangible storage of information such as computer-readable instructions,data structures, program modules or other data. Computer readablestorage media includes, but is not limited to, RAM, ROM, EPROM, EEPROM,flash memory or other solid state memory technology, CD-ROM, DVD, orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other physical ormaterial medium which can be used to tangibly store the desiredinformation or data or instructions and which can be accessed by acomputer or processor.

Those skilled in the art will recognize that the methods and systems ofthe present disclosure may be implemented in many manners and as suchare not to be limited by the foregoing exemplary embodiments andexamples. In other words, functional elements being performed by singleor multiple components, in various combinations of hardware and softwareor firmware, and individual functions, may be distributed among softwareapplications at either the client or server or both. In this regard, anynumber of the features of the different embodiments described herein maybe combined into single or multiple embodiments, and alternateembodiments having fewer than, or more than, all of the featuresdescribed herein are possible. Functionality may also be, in whole or inpart, distributed among multiple components, in manners now known or tobecome known. Thus, myriad software/hardware/firmware combinations arepossible in achieving the functions, features, interfaces andpreferences described herein. Moreover, the scope of the presentdisclosure covers conventionally known manners for carrying out thedescribed features and functions and interfaces, as well as thosevariations and modifications that may be made to the hardware orsoftware or firmware components described herein as would be understoodby those skilled in the art now and hereafter.

While the system and method have been described in terms of one or moreembodiments, it is to be understood that the disclosure need not belimited to the disclosed embodiments. It is intended to cover variousmodifications and similar arrangements included within the spirit andscope of the claims, the scope of which should be accorded the broadestinterpretation so as to encompass all such modifications and similarstructures. The present disclosure includes any and all embodiments ofthe following claims.

The invention claimed is:
 1. A method comprising: receiving, by aresource control system server computer and from a resource provider, aresource comprising executable code; storing, by the resource controlserver computer and prior to performing an analysis of the receivedresource, an approval status for the received resource, the approvalstatus being used to determine whether or not to grant access to theresource by a client computing device, of a number of client computingdevices serviced by the resource control system; performing, by theresource control system server computer and using an automated codeanalysis tool, the analysis of the executable code of the receivedresource, the analysis generating a result of the analysis; updating, bythe resource control system server computer, the approval status inaccordance with the result of the analysis, the approval status beingupdated to indicate that the received resource is not approved foraccess by the client computing device if the result of the analysisindicates a prohibited operation by the received resource; receiving, bythe resource control system server computer and from the clientcomputing device, a request for the resource; generating, by theresource control system server computer, a response to the resourcerequest using the approval status; and providing, by the resourcecontrol system server computer and to the client computing device, theresponse to the request for the resource based on the determination. 2.The method of claim 1, further comprising: determining, by the resourcecontrol system server computer, that the resource provider is a trustedentity; and the storing comprising storing the approval status settingas approved indicating that the received resource is available foraccess by the client computing device prior to the analysis of thereceived resource.
 3. The method of claim 2, the storing furthercomprising: storing a time associated with the approval status setting;and updating the approval status of the received resource as unapprovedif a threshold period of freshness expires before performing theanalysis of the received resource, expiration of the threshold period offreshness being determined using the storing time associated with theapproval status setting.
 4. The method of claim 1, further comprising:determining, by the resource control system server computer and prior toperforming the analysis, that the resource provider is not a trustedentity; and the storing comprising storing the approval status settingas unapproved indicating that the received resource is unavailable foraccess by the client computing device prior to the analysis of thereceived resource.
 5. The method of claim 1, the storing comprisingstoring information identifying the resource provider.
 6. The method ofclaim 1, the storing comprising storing information identifying a latestversion of the resource approved for access by the client computingdevice resource provider.
 7. The method of claim 1, the storingcomprising storing user authorization information identifying a numberof users authorized to access the resource.
 8. The method of claim 7,the generating using the approval status and information indicating auser's authorization to access the resource in generating the response.9. The method of claim 1, performing the analysis of the executable codeof the received resource further comprising: analyzing the resource todetermine whether or not the received resource includes an unapprovedoperation to access browser of the client computing device.
 10. Themethod of claim 1, performing the analysis of the executable code of thereceived resource further comprising: analyzing the resource todetermine whether or not the received resource includes an unapprovedoperation to transmit information stored by the client computing deviceto a suspect destination.
 11. The method of claim 1, the analysis of thereceived resource is performed in response to receiving the request forthe resource.
 12. A non-transitory computer-readable storage mediumtangibly encoded with computer-executable instructions that whenexecuted by a processor associated with a resource control system serverperform a method comprising: receiving, from a resource provider, aresource comprising executable code; storing, prior to performing ananalysis of the received resource, an approval status for the receivedresource, the approval status being used to determine whether or not togrant access to the resource by a client computing device, of a numberof client computing devices serviced by the resource control system;performing, using an automated code analysis tool, the analysis of theexecutable code of the received resource, the analysis generating aresult of the analysis; updating the approval status in accordance withthe result of the analysis, the approval status being updated toindicate that the received resource is not approved for access by theclient computing device if the result of the analysis indicates aprohibited operation by the received resource; receiving, from theclient computing device, a request for the resource; generating aresponse to the resource request using the approval status; andproviding, to the client computing device, the response to the requestfor the resource based on the determination.
 13. The non-transitorycomputer-readable storage medium of claim 12, further comprising:determining that the resource provider is a trusted entity; and thestoring comprising storing the approval status setting as approvedindicating that the received resource is available for access by theclient computing device prior to the analysis of the received resource.14. The non-transitory computer-readable storage medium of claim 13, thestoring further comprising: storing a time associated with the approvalstatus setting; and updating the approval status of the receivedresource as unapproved if a threshold period of freshness expires beforeperforming the analysis of the received resource, expiration of thethreshold period of freshness being determined using the storing timeassociated with the approval status setting.
 15. The non-transitorycomputer-readable storage medium of claim 12, further comprising:determining, prior to performing the analysis, that the resourceprovider is not a trusted entity; and the storing comprising storing theapproval status setting as unapproved indicating that the receivedresource is unavailable for access by the client computing device priorto the analysis of the received resource.
 16. The non-transitorycomputer-readable storage medium of claim 12, the storing comprisingstoring user authorization information identifying a number of usersauthorized to access the resource.
 17. The non-transitorycomputer-readable storage medium of claim 16, the generating using theapproval status and information indicating a user's authorization toaccess the resource in generating the response.
 18. The non-transitorycomputer-readable storage medium of claim 12, performing the analysis ofthe executable code of the received resource further comprising:analyzing the resource to determine whether or not the received resourceincludes an unapproved operation to transmit information stored by theclient computing device to a suspect destination.
 19. The non-transitorycomputer-readable storage medium of claim 12, the analysis of thereceived resource is performed in response to receiving the request forthe resource.
 20. A resource control system server comprising: aprocessor; a non-transitory storage medium for tangibly storing thereonprogram logic for execution by the processor, the program logiccomprising: receiving instructions executed by the processor forreceiving, from a resource provider, a resource comprising executablecode; storing instructions executed by the processor for storing, priorto performing an analysis of the received resource, an approval statusfor the received resource, the approval status being used to determinewhether or not to grant access to the resource by a client computingdevice, of a number of client computing devices serviced by the resourcecontrol system; performing instructions executed by the processor forperforming, using an automated code analysis tool, the analysis of theexecutable code of the received resource, the analysis generating aresult of the analysis; updating instructions executed by the processorfor updating the approval status in accordance with the result of theanalysis, the approval status being updated to indicate that thereceived resource is not approved for access by the client computingdevice if the result of the analysis indicates a prohibited operation bythe received resource; receiving instructions executed by the processorfor receiving, from the client computing device, a request for theresource; generating instructions executed by the processor forgenerating a response to the resource request using the approval status;and providing instructions executed by the processor for providing, tothe client computing device, the response to the request for theresource based on the determination.